Speaking of authorization...

James McGovern asked in a recent post: "In the same way that Kim Cameron is running around Microsoft rallying for the need to rationalize identity, I wonder who his peer is for doing something similar with authorization?" I actually wonder, too. Is it (should it?) be my buddy Don Schmidt over at Microsoft? I don't know but it is about time for an authorization czar over there.

While I was thinking about this I stumbled across a post and a video that shows how to create and add roles to Microsoft's Systems Center Operations Manager 2007. As I watched the video I was pleasantly surprised to see that they really did use Active Directory users to "fill" the roles that they demoed. A nice step forward but are they open to enhancing that capability?

What you have enabled in SCOM 2007 is the ability to define a static role and a static set of users who fit that role. Who is maintaining the role and the users? Well, the SCOM 2007 administrator is. Every time a new user needs to be added to a role or a new role is required that admin has to do the work. You've basically shuffled the work from the help desk or Active Directory administrator to the SCOM 2007 administrator - that's just a shell game with no real productivity gain.

I'd recommend that you virtualize the user side of this equation. Specifically, most users in Active Directory have a series of attributes attached to their object such as title, manager, office location, phone number, etc. A role should have the ability to have attributes and specific values assigned to them so that role can be checked dynamically at use to see if a user is authorized for that function. An example might be that you'd like everyone who has title "SQL Administrator" to be able to manage and operate the monitoring of the SQL servers. This is easier than every new SQL Administrator having to email you to be added to the role manually. And, when they get promoted to "Product Manager" they automagically get dropped from that role - again, without the need for an email to you, Mr. SCOM2007 Administrator.

This way you enable the directory to do the work for you. I call that improving efficiency - yours.

It bothers me that at Microsoft this stuff isn't leaking through faster into everyday design and architecture...

Technorati Tags:
Microsoft, Systems Center Operations Manager 2007, Active Directory, identity management, authorization

New York City and Food Poisoning

As I mentioned previously I visited New York City last week to meet with customers and partners. I'll post about those meetings next week but thought I'd post about my first experience with food poisoning. Why? The ensuing dialog - after the fact - with some of our local sales execs:

Sales dude: "Let's go down to the cafe and get some pizza."

Jackson (in a stage whisper): "Yah, they'll give you food poisoning like they gave me. It's included in the price."

Sales dudes all board the down elevator with me: "What happened?"

Jackson: "I ordered a peppered turkey sandwich with mayo and spent the night feeling like I was going to die."

Sales dude: "You ordered an already prepared sandwich out of the case or you had them make one in front of you?"

Jackson: "One from the case."

Sales dudes (all laughing): "Of course you got food poisoning! You don't get an already prepared sandwich from a New York City deli, you get one freshly made in front of your eyes. Where are you from anyway?"

Jackson (sheepishly): "Seattle"

Sales dude: "Oh, from the country, eh? First trip to the City? Welcome to New York."

Sales dude (as elevator door opens) to other sales dudes: "So it's to the cafe then for their freshly made pizza. Jackson, you up for a slice?" (insert sales dudes laughter here)

Technorati Tags:
Quest Software

Federation? Oh, you mean Star Trek!

Had to laugh at this one. I know that we all - including me - have the tendency to start breathing our own exhaust. This posting by Ping Identity brought back to mind a humorous comment that took place in a focus group market study I did on federation a few years back...

We asked the participants to write out a definition to a series of directory-related terms. We actually ran the focus groups in 3 cities (Chicago, New York and LA) and had 3 focus groups in each city (2 for enterprise-size companies and 1 for small/medium businesses). We filmed and taped the sessions which were professionally moderated. The participants did not know that Microsoft was "behind the glass".

When I presented the findings back in Redmond I did out-takes from the videos to highlight the unusual or interesting. The piece that drew that greatest laugh was when an attendee put up their hand to ask for clarification on the what we meant by the term "federation". His question:

"Do you mean like Star Trek?"

Have we progressed much further than that in the last 3-4 years? I'm not sure. I think the average IT director/administrator/manager, CxO, and CISO probably would ask the same question today.

What do you think? Scotty, will we ever get this bucket to warp speed?

Technorati Tags:
federation

It's the Directory, Stupid

I've caught up on e-mail - now I'm catching up on my Google Reader and the 677 unread blog items in it. One of the first items I saw caught my eye immediately - "It's the Directory, Stupid", an e-Week article which I saw over at my friend Don Bowen's blog: Wizard of IdM.

Here's the gist of Jason Brooks' article:

Until Red Hat, Novell, or another party focuses around open-source directory services, Linux will be stuck playing catch-up with Windows 2000.

Well, how can I disagree with that? Especially since I was part of the Windows 2000 - and most specifically - the Active Directory launch team! However, it is a pretty sad commentary when basically you are saying that Active Directory is the thought leader. Yes, it is the market leader - absolutely and without a doubt. However, like any product Active Directory has its own set of warts that Microsoft hasn't cleaned up nor are they showing any particular leadership towards Active Directory V2. (Please! Don't get me started on schema modifications!!)

All that said, I'd recommend Jason - and others - take a look at what's going on over at Apache's Directory Project - I find it pretty intriguing. Lots of potential...

ApacheDS is an embeddable directory server entirely written in Java, which has been certified LDAPv3 compatible by the Open Group. Besides LDAP it supports Kerberos 5 and the Change Password Protocol. It has been designed to introduce triggers, stored procedures, queues and views to the world of LDAP which has lacked these rich constructs.

I love how they have bowed to incorporating two-factor authentication into the directory via their "Triple Sec" product along with an Eclipse-based directory studio. What better way to move to a services-oriented architecture than with a well thought out, Java-based directory service?

Technorati Tags:
Microsoft, Active Directory, identity management